You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 2, 2025. It is now read-only.
To configure your GCP service, follow these steps:
43
+
To configure your GCP service:
123
44
124
-
#. In a new window or tab, go to the Google Cloud Platform website, and log into your GCP account.
125
-
#. Open the GCP web console, and select a project you want to monitor.
126
-
#. From the sidebar, select :menuselection:`IAM &admin`, then :menuselection:`Service Accounts`.
127
-
#. Go to :guilabel:`Create Service Account` at the top of the screen, and complete the following fields:
45
+
#. Log into your GCP account and select the project you want to monitor in the GCP web console.
128
46
129
-
.. list-table::
130
-
:header-rows: 1
131
-
:widths: 40 60
47
+
#. From the sidebar, select :menuselection:`IAM &admin`, then :menuselection:`Service Accounts`.
132
48
133
-
* - :strong:`Field`
134
-
- :strong:`Description`
49
+
#. Go to :guilabel:`Create Service Account` at the top of the screen, complete the following fields, and select :guilabel:`CREATE`.
135
50
136
-
* - Service account name
137
-
- Enter ``Splunk``.
51
+
* **Service account name**. Enter ``Splunk``.
138
52
139
-
* - Service account ID
140
-
- This field autofills after you enter ``Splunk`` for Service account name.
53
+
* **Service account ID**. This field autofills after you enter ``Splunk`` for Service account name.
141
54
142
-
* - Service account description
143
-
- Enter the description for your service account.
55
+
* **Service account description**. Enter the description for your service account.
144
56
145
-
#. Select :guilabel:`CREATE`.
146
57
#. (Optional) Select a role to grant this Service account access to the selected project, then select :guilabel:`CONTINUE`.
147
-
#. Activate Key type :guilabel:`JSON`, and select :guilabel:`CREATE`. A new service account key JSON file is then downloaded to your computer.
148
-
#. In a new window or tab, go to :new-page:`Cloud Resource Manager API <https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com?pli=1>`, and activate the Cloud Resource Manager API. You need to activate this API so Splunk Infrastructure Monitoring can use it to validate permissions on the service account keys.
58
+
59
+
#. Activate Key type :guilabel:`JSON`, and select :guilabel:`CREATE`. A new service account key JSON file is then downloaded to your computer. You will need this key to authenticate in Splunk Observability Cloud.
60
+
61
+
#. In a new window or tab, go to :new-page:`Cloud Resource Manager API <https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com?pli=1>`, and activate the Cloud Resource Manager API. You need to activate this API so Splunk Observability Cloud can use it to validate permissions on the service account keys.
149
62
150
63
.. _gcp-projects:
151
64
152
65
.. note:: To monitor multiple GCP projects, repeat the steps described in this section for each one of the projects.
153
66
154
67
.. _gcp-three:
155
68
156
-
3. Start the integration
69
+
3. Connect to Splunk Observability Cloud and start the integration
By default, all supported services are monitored, and any new services added later are also monitored. When you set integration parameters, you can choose to import metrics from a subset of the available services.
72
+
By default, Splunk Observability Cloud monitors all supported services, and any new services added later are also monitored. When you set integration parameters, you can choose to import metrics from a subset of the available services.
160
73
161
-
#. Log in to Splunk Observability Cloud.
162
-
#. Open the :new-page:`Google Cloud Platform guided setup <https://login.signalfx.com/#/integrations/gcp>`. Optionally, you can navigate to the guided setup on your own:
74
+
#. Log in to Splunk Observability Cloud and open the :new-page:`Google Cloud Platform guided setup <https://login.signalfx.com/#/integrations/gcp>`. Optionally, you can navigate to the guided setup on your own:
163
75
164
-
#. In the navigation menu, select :menuselection:`Data Management`.
76
+
#. In the left navigation menu, select :menuselection:`Data Management`.
165
77
166
78
#. Go to the :guilabel:`Available integrations` tab, or select :guilabel:`Add Integration` in the :guilabel:`Deployed integrations` tab.
167
79
168
80
#. In the integration filter menu, select :guilabel:`By Use Case`, and select the :guilabel:`Monitor Infrastructure` use case.
169
81
170
82
#. In the :guilabel:`Cloud Integrations` section, select the :guilabel:`Google Cloud Platform` tile to open the Google Cloud Platform guided setup.
171
83
172
-
#. Go to :guilabel:`New Integration`.
84
+
#. In the GCP guided setup enter a name for your new GCP integration, then :guilabel:`Add Project`.
173
85
174
-
#. Enter a name for the new GCP integration, then :guilabel:`Add Project`.
175
86
#. Next, select :guilabel:`Import Service Account Key`, and select one or more of the JSON key files that you downloaded from GCP in :ref:`Configure GCP <gcp-two>`.
87
+
176
88
#. Select :guilabel:`Open`. You can then see the project IDs corresponding to the service account keys you selected.
89
+
177
90
#. To import :ref:`metrics <gcp-metrics>` from only some of the available services, follow these steps:
178
91
179
92
- Go to :guilabel:`All Services` to display a list of the services you can monitor.
180
93
- Select the services you want to monitor, and then :guilabel:`Apply`.
181
94
182
-
#. Select the rate (in seconds) at which you want Splunk Observability Cloud to poll GCP for metric data, with 1 minute as the minimum unit, and 10 minutes as the maximum unit. For example, a value of 300 polls metrics once every 5 minutes.
183
-
#. Optional:
95
+
#. Select the rate (in seconds) at which you want Splunk Observability Cloud to poll GCP for metric data, with 1 minute as the minimum unit, and 10 minutes as the maximum unit. For example, a value of 300 polls metrics once every 5 minutes.
184
96
185
-
- List any additional GCP service domain names that you want to monitor, using commas to separate domain names in the :strong:`Custom Metric Type Domains` field.
186
-
187
-
- For example, to obtain Apigee metrics, add ``apigee.googleapis.com``.
188
-
- To learn about custom metric type domain syntax, see :new-page:`Custom metric type domain examples <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Custom-metric-type-domain-examples>` in the Splunk developer documentation.
97
+
Your GCP integration is now complete.
189
98
190
-
- If you select Compute Engine as one of the services to monitor, you can enter a comma-separated list of Compute Engine Instance metadata keys to send as properties. These metadata keys are sent as properties named ``gcp_metadata_<metadata-key>``.
99
+
.. note:: Splunk is not responsible for data availability, and it can take up to several minutes (or longer, depending on your configuration) from the time you connect until you start seeing valid data from your account.
191
100
192
-
- Select :strong:`Use quota from the project where metrics are stored` to use a quota from the project where metrics are stored. The service account provided for the project needs either the ``serviceusage.services.use`` permission, or the `Service Usage Consumer` role.
101
+
Options
102
+
++++++++
193
103
194
-
Your GCP integration is now complete.
104
+
Optionally you can:
195
105
196
-
.. note:: Splunk is not responsible for data availability, and it can take up to several minutes (or longer, depending on your configuration) from the time you connect until you start seeing valid data from your account.
106
+
* To list any additional GCP service domain names that you want to monitor, use commas to separate domain names in the :strong:`Custom Metric Type Domains` field. For example, to obtain Apigee metrics, add ``apigee.googleapis.com``.
107
+
108
+
- For information on the available GCP metric domains refer to the official GCP docs at :new-page:`Google Cloud metrics <https://cloud.google.com/monitoring/api/metrics_gcp>`.
109
+
110
+
- To learn about custom metric type domain syntax, see :new-page:`Custom metric type domain examples <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Custom-metric-type-domain-examples>` in the Splunk developer documentation.
111
+
112
+
* If you select Compute Engine as one of the services to monitor, you can enter a comma-separated list of Compute Engine Instance metadata keys to send as properties. These metadata keys are sent as properties named ``gcp_metadata_<metadata-key>``.
113
+
114
+
* Select :strong:`Use quota from the project where metrics are stored` to use a quota from the project where metrics are stored. The service account provided for the project needs either the ``serviceusage.services.use`` permission, or the `Service Usage Consumer` role.
197
115
198
116
Alternatives to connect to GCP
199
117
============================================
@@ -203,7 +121,9 @@ Alternatives to connect to GCP
You can also integrate GCP with Splunk Observability Cloud using the GCP API. See :new-page:`Integrate Google Cloud Platform Monitoring with Splunk Observability Cloud <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Specifying-custom-metric-type-domains>` in our developer portal for details.
124
+
You can also integrate GCP with Splunk Observability Cloud using the GCP API.
125
+
126
+
See :new-page:`Integrate Google Cloud Platform Monitoring with Splunk Observability Cloud <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview#Specifying-custom-metric-type-domains>` in our developer portal for details.
:description: Connect your Google Cloud Platform / GCP account to Splunk Observability Cloud.
10
9
11
-
The following pre-requisites apply:
10
+
.. _gcp-prerequisites:
12
11
13
-
* You must be an administrator of your Splunk Observability Cloud organization to create a GCP connection.
14
-
* Splunk Observability Cloud supports all GCP regions.
12
+
Prerequisites
13
+
============================================
15
14
16
-
Account permissions
15
+
You must be an administrator of your Splunk Observability Cloud organization to create a GCP connection.
16
+
17
+
Authenticate your Google account
17
18
============================================
18
19
19
-
Starting in March 2024, GCP disables service account key creation by setting ``iam.disableServiceAccountKeyCreation`` to ``false`` by default. When this constraint is set, you cannot create user-managed credentials for service accounts in projects affected by the constraint. Check the restrictions on your organization's account keys before connecting to Splunk Observability Cloud.
20
+
You need your service account keys to be able to integrate your GCP services with Splunk Observability Cloud. Check the restrictions on your organization's account keys before connecting to Splunk Observability Cloud.
21
+
22
+
For more information, refer to:
23
+
24
+
* GCP's docs on :new-page:`Service account keys <https://cloud.google.com/iam/docs/service-account-creds#key-types>`
25
+
* Google's official announcement on the new permission policies at :new-page:`Introducing stronger default Org Policies for our customers <https://cloud.google.com/blog/products/identity-security/introducing-stronger-default-org-policies-for-our-customers/>`
Alternatively, if you're connecting to Splunk Observability Cloud using the API you can use :new-page:`GCP's Workload Identity Federation (WIF) <https://cloud.google.com/iam/docs/workload-identity-federation>` to access your Google Cloud resources and authenticate them. It's safer, and with WIF you won't have to export and rotate service account keys.
31
+
32
+
See how to authenticate with WIF in the Splunk Observability Cloud developer documentation at :new-page:`Integrate GCP <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview>`.
33
+
34
+
.. _gcp-prereqs-role-permissions:
35
+
36
+
GCP role permissions
37
+
============================================
38
+
39
+
You can use GCP's :strong:`Viewer` role as it comes with the permissions you need for most scenarios.
40
+
41
+
Alternatively you can create a more restrictive role using the permissions in the table:
42
+
43
+
.. list-table::
44
+
:header-rows: 1
45
+
:widths: 35 45 20
46
+
47
+
* - :strong:`Permission`
48
+
- :strong:`Required?`
49
+
- :strong:`Included in GCP's Viewer role?`
50
+
51
+
* - ``compute.instances.list``
52
+
- Yes, if the Compute Engine service is activated
53
+
- Yes
54
+
55
+
* - ``compute.machineTypes.list``
56
+
- Yes, if the Compute Engine service is activated
57
+
- Yes
58
+
59
+
* - ``container.clusters.list``
60
+
- Yes, if the Kubernetes (GKE) service is activated
61
+
- Yes
20
62
21
-
For more information, refer to Google's official announcement :new-page:`Introducing stronger default Org Policies for our customers <https://cloud.google.com/blog/products/identity-security/introducing-stronger-default-org-policies-for-our-customers/>`.
63
+
* - ``container.nodes.list``
64
+
- Yes, if the Kubernetes (GKE) service is activated
65
+
- Yes
66
+
67
+
* - ``container.pods.list``
68
+
- Yes, if the Kubernetes (GKE) service is activated
69
+
- Yes
70
+
71
+
* - ``monitoring.metricDescriptors.get``
72
+
- Yes
73
+
- Yes
74
+
75
+
* - ``monitoring.metricDescriptors.list``
76
+
- Yes
77
+
- Yes
78
+
79
+
* - ``monitoring.timeSeries.list``
80
+
- Yes
81
+
- Yes
82
+
83
+
* - ``resourcemanager.projects.get``
84
+
- Yes, if you want to sync project metadata (such as labels)
85
+
- Yes
86
+
87
+
* - ``serviceusage.services.use``
88
+
- Yes, if you either want to activate the use of a quota from the project where metrics are stored or sync cloud sql metadata
89
+
- No, but included in ``roles/serviceusage.serviceUsageConsumer``
90
+
91
+
* - ``spanner.instances.list``
92
+
- Yes, if the Spanner service is activated
93
+
- Yes
94
+
95
+
* - ``storage.buckets.list``
96
+
- Yes, if the Spanner service is activated
97
+
- Yes
98
+
99
+
* - ``cloudsql.databases.list``
100
+
- Yes, if the cloud sql service is activated
101
+
- Yes
102
+
103
+
* - ``cloudsql.instances.list``
104
+
- Yes, if the cloud sql service is activated
105
+
- Yes
106
+
107
+
* - ``pubsub.topics.list``
108
+
- Yes, if the pub/sub service is activated
109
+
- Yes
110
+
111
+
* - ``pubsub.subscriptions.list``
112
+
- Yes, if the pub/sub service is activated
113
+
- Yes
114
+
115
+
* - ``run.jobs.list``
116
+
- Yes, if the cloud run service is activated
117
+
- Yes
118
+
119
+
* - ``run.revisions.list``
120
+
- Yes, if the cloud run service is activated
121
+
- Yes
122
+
123
+
* - ``cloudasset.assets.searchAllResources``
124
+
- Yes, if the cloud run service is activated
125
+
- Yes
126
+
127
+
* - ``cloudfunctions.functions.list``
128
+
- Yes, if the cloud functions service is activated
129
+
- Yes
130
+
131
+
.. _gcp-prereqs-regions:
132
+
133
+
Supported regions
134
+
============================================
22
135
136
+
Splunk Observability Cloud supports all GCP regions.
0 commit comments